ServiceNow CIS-EM Practice Test Questions, Exam Dumps

Practice Exams:

View All

CIS-EM ServiceNow Practice Test Questions and Exam Dumps

Question No 1:

When creating an alert management rule, where would you specify a workflow to resolve a given condition?

A. From the Remediation tab
B. From the Actions tab
C. From the Launcher tab
D. In the Related Links section

Correct Answer: A

Explanation:

Alert management rules are part of an IT operations or monitoring platform where conditions (alerts) are triggered based on specific events or thresholds. The goal of an alert management rule is to automate responses to certain conditions, ensuring efficient resolution and monitoring.

Let’s break down the options:

Option A: From the Remediation tab
The Remediation tab is where you would specify a workflow or action plan to resolve a given condition or alert. This is the appropriate place to define the steps or actions that should be taken when a specific alert condition is met, such as executing scripts, triggering workflows, or assigning tasks. This ensures that the alert is not only identified but also actively managed and resolved through automated workflows.
Option B: From the Actions tab
While the Actions tab is often used to define specific actions that should happen in response to an alert, it doesn’t specifically focus on workflows for resolution. Actions could involve notifications, logging, or triggering processes, but they are not the same as a workflow that manages the resolution process. Therefore, B is not the correct answer.
Option C: From the Launcher tab
The Launcher tab is generally used for initiating various tools or services, not specifically for managing workflows in the context of alert resolution. It is not typically where you would configure automated workflows for resolving alerts. Therefore, C is incorrect.
Option D: In the Related Links section
The Related Links section is often used to provide additional resources or references related to the alert or issue at hand, but it is not where you configure workflows. This section might contain links to documentation, help pages, or other related features, but it doesn't directly involve specifying workflows for resolution. Thus, D is not the right choice.

In conclusion, A (the Remediation tab) is the correct place to specify a workflow for resolving a given condition when creating an alert management rule. This tab allows administrators to automate and streamline the process of addressing and resolving triggered alerts.

Question No 2:

What types of system can a MID Server install on? (Choose two.)

A. OpenVMS System
B. Microsoft Windows Server
C. Linux System
D. Microsoft Windows Desktop
E. Any system inside the customer firewall
F. Mac OS X System

Correct Answer: B, C

Explanation:

The MID (Management, Instrumentation, and Discovery) Server is a critical component in ServiceNow environments used to facilitate communication between ServiceNow instances and on-premises systems or data sources. The MID Server allows the ServiceNow platform to securely integrate with systems inside the corporate firewall or on a private network. Let's review each option to determine which systems can support the installation of a MID Server.

Option A: OpenVMS System
OpenVMS is an operating system from HP that has historically been used in high-availability environments, primarily in enterprise settings. However, the MID Server does not support OpenVMS. As a result, it cannot be installed on this system. The MID Server is not designed to operate on OpenVMS due to its limited compatibility with modern cloud-based tools like ServiceNow.

Option B: Microsoft Windows Server
A Microsoft Windows Server is a supported system for installing the MID Server. This operating system is widely used in enterprise IT environments, and the MID Server can be installed on it to allow communication between the ServiceNow instance and internal systems. Windows Server is commonly used to run the MID Server due to its compatibility with the MID Server installation requirements and integration features.

Option C: Linux System
A Linux system is also a supported platform for the MID Server installation. Many organizations use Linux servers for their internal systems, and the MID Server can be installed on Linux-based environments as well. Linux offers flexibility, security, and cost-effectiveness, making it a suitable choice for many enterprises to deploy the MID Server.

Option D: Microsoft Windows Desktop
The Microsoft Windows Desktop operating system (e.g., Windows 10, Windows 8) is typically not used to install the MID Server. The MID Server is designed to run in a server environment and requires higher performance and stability than a desktop operating system can provide. Therefore, it is not recommended to install the MID Server on a desktop version of Windows.

Option E: Any system inside the customer firewall
This option is a bit misleading. While it is true that the MID Server operates within the customer firewall for security and performance reasons, it must be installed on a compatible operating system. The choice of system must be either Windows Server or Linux, as described in the earlier options. Therefore, it is not an accurate description to say that the MID Server can be installed on any system inside the firewall, as only supported operating systems can host the MID Server.

Option F: Mac OS X System
The Mac OS X system is not supported for installing the MID Server. The MID Server requires an environment that can support the ServiceNow integrations, which is not typically compatible with macOS. The service and communication features of the MID Server are optimized for server-grade operating systems like Windows Server and Linux.

The MID Server can be installed on Microsoft Windows Server (B) and Linux System (C) because these operating systems are fully compatible with the server and enterprise-grade requirements of the MID Server. Other systems, such as OpenVMS, Mac OS X, or desktop versions of Windows, are not supported for installing the MID Server.

Question No 3:

What would be the primary use case for creating Javascripts in Event Management?

A. To create a customized pull connector to retrieve events on behalf of an event source
B. To automatically populate the Configuration Management Database (CMDB)
C. To parse a nodename out of your raw event data in an event rule
D. To run as part of a remediation workflow for IT alerts that fail to execute

Correct answer: C

Explanation:

In Event Management, JavaScript is often used to process and manipulate event data as it flows through the system. A key use case for creating JavaScripts is to parse raw event data for specific information that is needed for further processing or decision-making. This is particularly useful when you need to extract certain elements from the event data, such as a nodename, which could be used for subsequent analysis or triggering alerts.

Here’s a breakdown of the options:

Option A (To create a customized pull connector to retrieve events on behalf of an event source): While this is a valid use case in event management, it typically requires integration work and possibly REST API calls or other connectors, not necessarily JavaScript. Custom connectors usually involve more complex integration setups rather than event rule customization with JavaScript.
Option B (To automatically populate the Configuration Management Database (CMDB)): Although JavaScript can be used in some automation workflows, automatically populating the CMDB is typically done through integration processes or automated discovery tools, not through JavaScript embedded in event rules. The JavaScript use case would focus on parsing or manipulating event data, but not on CMDB population directly.
Option D (To run as part of a remediation workflow for IT alerts that fail to execute): Remediation workflows might include automation scripts, but this is not the primary use of JavaScript in event management. JavaScript would be used more for parsing data and triggering certain conditions in response to events, rather than acting as a remediation tool directly.

Thus, the primary use case for creating JavaScripts in Event Management is to parse a nodename out of raw event data. This allows for more granular control over how events are processed and ensures that the necessary data is extracted for further processing or alert generation.

Question No 4:

What would you use to define the monitoring sources allowed to communicate with the ServiceNow instance for Operational Intelligence?

A. Metric Registration
B. Metric Config Rules
C. Metric Type Actions
D. Metric to CI

Correct answer: A

Explanation:

In ServiceNow, Operational Intelligence is a feature used to analyze and gain insights from data, primarily focusing on metrics and performance indicators. To allow certain monitoring sources (like servers, devices, or other infrastructure) to communicate with the ServiceNow instance for operational intelligence purposes, the monitoring sources must be registered. This is where Metric Registration comes into play.

A. Metric Registration:
Metric Registration is the process used to define and register the monitoring sources that are allowed to communicate with the ServiceNow instance. This allows the system to track the performance data from various monitoring tools and devices. By registering the sources of data (such as monitoring systems), the ServiceNow platform can import, analyze, and visualize the relevant metrics for operational intelligence. This process ensures that the correct data streams are integrated with ServiceNow for further processing.

Now, let’s look at the other options:

B. Metric Config Rules:
Metric Config Rules are used to configure how metric data should be collected and how the platform should respond to specific conditions. While useful for defining the behavior and thresholds of the data, it does not specifically control which monitoring sources are allowed to communicate with the ServiceNow instance. This option deals more with how data is handled once it's collected, rather than the registration of the monitoring sources.

C. Metric Type Actions:
Metric Type Actions define specific actions that can be triggered when certain metric types meet defined conditions. These actions might include things like alerting or creating incidents based on metric data. However, this option is focused on what happens when specific metrics meet certain conditions, rather than on defining or controlling the sources of the data itself.

D. Metric to CI:
The Metric to CI (Configuration Item) feature in ServiceNow links metrics to specific configuration items. While this is important for associating performance data with the underlying infrastructure, it does not define or manage the sources of the monitoring data. It's more about associating the data with the correct assets within the ServiceNow CMDB.

Thus, A. Metric Registration is the correct choice because it is specifically responsible for defining the monitoring sources that are allowed to communicate with the ServiceNow instance for Operational Intelligence, enabling the platform to collect and analyze performance data effectively.

Question No 5:

The value of the Alert Priority score is a composite of what?

A. The value of the alert’s category and its relative weight
B. The value of the alert’s category and its Priority Group
C. The value of the alert’s Severity and its Priority Group
D. The value of the alert’s Severity and its relative weight

Correct answer: D

Explanation:

The Alert Priority score is typically determined by combining two key factors: Severity and relative weight. Here's why:

Option D: The value of the alert’s Severity and its relative weight.
The Severity of an alert indicates how critical or urgent the alert is, while the relative weight reflects the importance of different aspects of the alert based on the context or configuration settings. The Alert Priority score is a composite value calculated from these two parameters. This allows the system to prioritize alerts more effectively by not only considering how serious an issue is (severity) but also how much impact it should have in terms of response or escalation (relative weight). This is the most commonly used method to evaluate the overall importance of an alert.
Option A: The value of the alert’s category and its relative weight.
While the category of an alert can provide useful information about the type of issue, it does not directly impact the calculation of the priority score in most systems. The category can influence the overall handling of the alert but is not typically used as a primary factor in the calculation of the Alert Priority score.
Option B: The value of the alert’s category and its Priority Group.
The Priority Group may indeed be relevant in some systems for determining how an alert is grouped and how it should be treated, but it is not typically the primary factor in calculating the Alert Priority score. The category alone, without considering the severity or relative weight, doesn't directly affect the alert's priority.
Option C: The value of the alert’s Severity and its Priority Group.
The Priority Group is related to how alerts are organized into categories for easier management or escalation but does not generally combine with Severity to calculate the Alert Priority score. The relative weight is more directly involved in calculating the score than the Priority Group.

In conclusion, the Alert Priority score is most accurately calculated by combining Severity and relative weight to reflect both the criticality and the context of the alert. Therefore, Option D is the correct answer.

Question No 6:

Which attribute is responsible for de-duplication?

A. Metric_name
B. Message_key
C. Short_description
D. Additional_info

Correct Answer: B

Explanation:

In the context of systems like incident management or log aggregation tools, de-duplication is a process that ensures that duplicate entries or events are not recorded multiple times. This is crucial for maintaining the integrity of data and preventing redundant alerts or incidents. Let's break down each option:

A. Metric_name
Metric_name is typically used to identify specific types of metrics or performance data. While it helps in categorizing and organizing data, it is not directly responsible for de-duplication. Metric_name would be used for monitoring or tracking purposes, but not to prevent duplicate entries.
B. Message_key
Message_key is the correct answer. The message_key is a unique identifier used to group similar messages or events together. When de-duplication is necessary, systems often use the message key to identify if the event or message has already been processed or recorded. If the message with the same message_key already exists, it will be discarded or ignored, ensuring that duplicate messages are not recorded. This makes message_key the primary attribute for de-duplication.
C. Short_description
Short_description typically provides a brief summary or title of an incident or message. While it might describe the issue, it is not a unique identifier, and as such, it is not used to de-duplicate entries. Multiple incidents could have the same short description, which would make this attribute unreliable for de-duplication.
D. Additional_info
Additional_info usually contains extra context or details about an incident or event, such as logs, descriptions, or additional parameters. While useful for providing more information, it does not serve as a unique identifier for de-duplication purposes. Therefore, additional_info is not used to prevent duplication.

The attribute that is primarily responsible for de-duplication is the message_key because it serves as a unique identifier that helps in distinguishing between new and duplicate messages or events. Therefore, the correct answer is B.

Question No 7:

How would you interpret the following data in the Operational Intelligence Insights Explorer?

A. win-ces882ierw is one of your hottest Configuration Items (CIs) that is currently experiencing a high probability of anomalies and should be checked immediately
B. win-ces882ierw is one of your hottest Configuration Items (CIs), but is currently experiencing a low probability of anomalies
C. win-ces882ierw is one of your customized list of monitored Configuration Items (CIs) that is currently experiencing a high probability of anomalies and should be checked immediately
D. win-ces882ierw is one of your customized list of monitored Configuration Items (CIs), but is currently experiencing a low probability of anomalies

Correct Answer: A

Explanation:

In the Operational Intelligence Insights Explorer, the interpretation of data regarding Configuration Items (CIs) typically involves understanding the CI’s status in relation to the likelihood of encountering issues or anomalies. Here’s how each option breaks down:

A. win-ces882ierw is one of your hottest Configuration Items (CIs) that is currently experiencing a high probability of anomalies and should be checked immediately: This is the most likely interpretation if "hottest" refers to the fact that this CI is currently showing elevated activity or metrics that suggest it is at risk of experiencing issues. A "high probability of anomalies" would mean that this CI is expected to behave abnormally soon or is already showing signs of instability, thus requiring immediate attention.
B. win-ces882ierw is one of your hottest Configuration Items (CIs), but is currently experiencing a low probability of anomalies: While this option also references a "hot" CI, the key difference here is that it mentions a "low probability of anomalies." This would indicate that while the CI may be under scrutiny, it is not expected to experience problems imminently. This interpretation does not align with the urgency implied by the need for checking the CI immediately.
C. win-ces882ierw is one of your customized list of monitored Configuration Items (CIs) that is currently experiencing a high probability of anomalies and should be checked immediately: This option includes the detail that the CI is from a "customized list of monitored CIs." While this could be true, it is an additional detail that does not necessarily change the core understanding of the CI's current state. Since the CI is experiencing a "high probability of anomalies," the need for checking it immediately is emphasized, but the "customized list" aspect doesn’t drastically change the interpretation.
D. win-ces882ierw is one of your customized list of monitored Configuration Items (CIs), but is currently experiencing a low probability of anomalies: This option implies that, while the CI is monitored within a customized list, it has a "low probability of anomalies," suggesting no immediate action is needed. This interpretation does not align with the need for urgency implied by the term "should be checked immediately."

Given the urgency implied in the data and the high likelihood of anomalies, the most accurate interpretation is that the CI is a "hot" item with a high probability of anomalies, which suggests the need for immediate investigation. Thus, the correct answer is A.

Question No 8:

What is the default collection/polling interval applied to all event connectors?

A. Every 120 seconds
B. Every 5 seconds
C. Every 40 seconds
D. Every 60 seconds
E. Every 10 seconds

Answer: D

Explanation:

The default collection/polling interval for event connectors in many systems, including cloud monitoring and event management platforms, is typically set to 60 seconds. This interval defines how often the system will check for new events or data updates from a connected source. A 60-second interval is a balanced approach that allows for timely updates without overwhelming the system with excessive polling requests. It also reduces the risk of system resource overutilization while maintaining a reasonable level of event detection.

Now, let's analyze why the other options are incorrect:

A. Every 120 seconds
A 120-second interval would result in less frequent polling, which could delay the detection of events or updates. While this might be appropriate for certain scenarios where real-time data is not critical, the standard default polling interval is usually shorter, around 60 seconds.

B. Every 5 seconds
Polling every 5 seconds would result in very frequent checks, which could overburden the system with excessive requests. Although it would provide near-real-time data collection, it's often unnecessary and inefficient unless specifically required by the use case.

C. Every 40 seconds
While 40 seconds could theoretically be a polling interval in some systems, it is not the standard default setting for most platforms. The typical default is closer to 60 seconds, as mentioned.

E. Every 10 seconds
Polling every 10 seconds could create a high load on both the system and the event connectors, and would be too frequent for most use cases. A 60-second interval is generally seen as the ideal compromise between timely updates and system efficiency.

Therefore, the default collection/polling interval for most event connectors is 60 seconds, making D the correct answer.

Question No 9:

Where can you look to determine what event rule created an alert? (Choose two.)

A. Alert Activity
B. Event Additional Information
C. Event Processing Notes
D. Alert Message Key
E. Alert Source

Answer: A, C

Explanation:

When trying to determine what event rule created an alert, the most useful places to look are typically within the Alert Activity and Event Processing Notes, as they provide detailed information about the alert's creation and processing steps.

Option A: Alert Activity
The Alert Activity section provides a detailed log of actions taken on the alert, including what event rule triggered the alert. This activity log will often contain information on the specific rule, conditions, or actions that led to the alert being generated. It's a useful place to track the lifecycle of the alert and determine which rule initiated it.
Option B: Event Additional Information
The Event Additional Information field typically contains supplementary details related to the event but does not necessarily include the specific event rule that created the alert. While this section might provide context or extra data about the event, it is not the primary location for determining the event rule responsible for the alert.
Option C: Event Processing Notes
Event Processing Notes often include important details regarding the processing of the event, including information about what rules were applied or how the event was handled. These notes can explicitly mention which event rule was responsible for triggering the alert. This is another key place to look for insights into the event rule that created the alert.
Option D: Alert Message Key
The Alert Message Key is used to identify the specific message format or template for the alert. While it is critical for understanding how the alert is displayed or communicated, it does not directly indicate which event rule created the alert.
Option E: Alert Source
The Alert Source specifies the origin of the alert but does not directly indicate the event rule responsible for its creation. This field helps in understanding where the alert originated from (e.g., the system or component that triggered the alert) but does not provide the granularity of information about the specific event rule.

Therefore, the best places to check to determine what event rule created an alert are the Alert Activity and Event Processing Notes. These sections provide detailed insights into the processing steps and the specific rule that triggered the alert.

Question No 10:

What feature would you use to trigger a workflow or automatically generate tasks via templates?

A. Event rules
B. Task rules
C. Alert management rules
D. Alert correlation rules

Correct Answer: A

Explanation:

To meet the requirement of triggering a workflow or automatically generating tasks based on certain conditions, it's essential to use a feature designed for event-driven actions. Let's break down the available options:

A. Event rules:
Event rules are designed specifically for automating actions based on specific events that occur in the system. These events can trigger workflows, tasks, or other automated responses, making them a perfect fit for automatically generating tasks or triggering workflows via templates. Event rules are commonly used to set conditions under which actions like creating tasks or starting workflows are initiated, often based on certain triggers or alerts.

B. Task rules:
Task rules typically define how tasks are created, assigned, or managed but do not directly deal with triggering workflows or event-based actions. While task rules help automate the handling of tasks, they are not generally used for the initial creation or triggering of workflows based on system events. Therefore, task rules are not the most appropriate choice for triggering workflows.

C. Alert management rules:
Alert management rules are focused on handling and managing alerts rather than automating workflows or task creation. They may be used to escalate alerts, notify users, or suppress them, but they do not trigger workflows or automatically generate tasks in the same way event rules do. Therefore, this option does not meet the requirement.

D. Alert correlation rules:
Alert correlation rules help group related alerts and provide a broader view of incidents or issues. While they may help with alert management, their primary purpose is to combine or correlate alerts into a single view for easier management and response. They do not focus on triggering workflows or automatically creating tasks, which makes this option less suitable for the described task.

In summary, A. Event rules is the best feature to use for triggering workflows or automatically generating tasks based on specific templates, as it is designed for handling events and automating responses in real-time.